TL;DR: Mastercard has launched Stablecoin Security, a risk-scoring tool designed to help financial institutions examine payments before and during their movement across blockchains.

Stablecoin transfers can settle quickly. Investigating a suspicious payment before it happens is a much harder task, particularly when the transaction crosses providers, blockchains and traditional banking systems.

Mastercard wants to tackle that problem with Stablecoin Security, introduced at Money20/20 in Las Vegas. The product combines conventional payment intelligence with blockchain data so banks and payment companies can assess fraud, sanctions and scam risks across a transfer’s journey.

The service works through an API and can generate a risk assessment before a transaction is completed. Mastercard says it can consider the payment context, the origin of the funds and potential exposure to restricted parties. Borderless.xyz and Keyrails are the initial partners.

For businesses considering stablecoin settlement, this fills an operational gap. A payment may be technically possible and still raise questions about counterparties, compliance or whether the funds arrived through a compromised wallet.

Mastercard’s announcement cites research covering 593 million stablecoin transfer events and 141 million Ethereum transactions in 2025, finding that almost 60% involved more complex, multi-step routes rather than simple one-to-one transfers.

The company is initially launching in North America and expects wider commercial availability in 2027. It isn’t promising to eliminate fraud, but it is bringing a familiar banking control into an increasingly unfamiliar payment environment.

Written by the News Desk and edited by Samuel Rae.

Crypto transfers move in seconds. Compliance data now has to move with them.

Send a bank wire and you send more than money. Somewhere in that message sits the name of the person paying and the person being paid.

Crypto never really worked that way. For a long time, a wallet address was about all you got.

That’s changing, and faster than many teams expected. The reason is the Crypto Travel Rule. Crypto businesses now have to tell each other who is sending and who is receiving when they move digital assets between themselves.

For exchanges, custodians, payment platforms and fintechs with a crypto feature, this isn’t something to plan for later. It’s already part of the plumbing.

What does it actually ask for, then, and why does it give teams so much trouble?

What Is the Crypto Travel Rule?

The rule traces back to FATF Recommendation 16. That global standard was written for plain old wire transfers.

Then in 2019, the Financial Action Task Force (FATF) applied it to virtual assets as well, and to Virtual Asset Service Providers (VASPs): exchanges, custodial wallet providers, brokers.

When one VASP sends crypto to another, the originator and beneficiary details have to “travel” with it, immediately and securely.

Worth saying clearly: the rule isn’t there to stop crypto transfers. It’s there to make them traceable, the way regulated fiat payments already are.

What Information Has to Travel?

Details differ by country. FATF guidance generally asks for the originator’s name, their account number or wallet address, and one extra identifier: a physical address, national ID number, customer ID, or date and place of birth.

On the receiving side, it’s the beneficiary’s name and their account number or wallet address.

FATF suggests a de minimis threshold of USD/EUR 1,000. Above that, the full data set should be collected and shared. Below it, a reduced set still applies, so small transfers don’t get a free pass.

Thresholds Are Not the Same Everywhere

Here’s where it gets messy. Each jurisdiction is free to implement the rule its own way.

A few examples:

• United States: a USD 3,000 threshold applies to certain transfers under Bank Secrecy Act rules
• European Union: Regulation (EU) 2023/1113 has applied since 30 December 2024. If an EU crypto asset service provider is involved, originator and beneficiary information is required, whatever the amount
• Self-hosted wallets in the EU: over EUR 1,000, the provider has to check whether the customer really owns or controls that wallet

Serving several markets? Then one workflow rarely covers it. Usually you end up maintaining a few.

Why the Travel Rule Is Hard to Implement

1. The Sunrise Problem

Not every country has adopted the rule yet. The ones that have don’t all enforce it the same way.

That leaves a compliant VASP in an awkward spot. It may have to send data to a counterparty in a country where the rule doesn’t apply yet, or to one that simply can’t receive the data.

2. Counterparty Identification

Before any data goes out, a VASP needs to know who is on the other end. Is the destination wallet held by another VASP, or is it self-hosted?

Answering that usually means combining blockchain analytics and wallet attribution data with due diligence on the counterparty VASP. Sometimes it also means simply asking the customer to declare it.

3. Interoperability Between Protocols

Travel Rule solutions don’t all speak the same language.

Most of the industry has settled on IVMS101 as a common data standard. Even so, two VASPs on different Travel Rule networks can still have trouble swapping information cleanly. A shared format doesn’t automatically mean a shared pipe.

4. Self-Hosted Wallets

With a self-hosted wallet, there’s no second VASP waiting to receive anything.

Depending on the jurisdiction, a business may have to collect the information from its own customer, verify who owns the wallet, or run extra risk-based checks instead.

5. Data Protection

Travel Rule data is personal data. That part gets overlooked.

VASPs have to share it securely and still meet their data protection obligations. In practice, that puts encryption, access control and secure API integration right at the centre of the build.

Where the Industry Stands in 2026

There’s real progress. It’s just uneven.

FATF’s seventh Targeted Update on virtual assets, published in July 2026, puts some numbers on it:

• 83% of surveyed jurisdictions (91 of 109) have passed Travel Rule legislation, up from 73% in 2025
• Another 11 jurisdictions say implementation is under way
• Almost half of jurisdictions with Travel Rule laws haven’t yet taken any related supervisory or enforcement action

Laws on paper, in other words, are running ahead of enforcement.

FATF also points out that most identified on-chain illicit activity now involves stablecoins. For payment businesses running on stablecoin rails, that ties Travel Rule compliance directly to how they move money every day.

What VASPs Should Build Into Their Infrastructure

A workable Travel Rule setup tends to include:

• KYC and KYB data that’s ready to share
• Counterparty VASP discovery and due diligence
• Wallet screening and blockchain analytics
• A messaging solution that supports IVMS101
• Rules for missing or incomplete information
• Self-hosted wallet verification workflows
• Secure data storage and record keeping
• Threshold logic for each jurisdiction

The point is to have compliance happen inside the transaction flow. Not as a manual review someone does after the money has already moved, because by then fixing a missing field is far harder.

The Future of Travel Rule Compliance

Stablecoin payments, on and off ramps, tokenized assets. All of it is drifting into mainstream finance, and the Travel Rule keeps dragging crypto infrastructure toward traditional AML frameworks.

A bank getting into digital assets will run into this. So will a fintech adding a crypto wallet, or a payment provider settling in stablecoins. Each ends up asking the same thing: can our systems share compliance data as fast as they move value?

In regulated crypto, the on-chain transfer is only half of it. The other half is the information that travels with it.

Build it in now and the later conversations get easier, with regulators, with banking partners, and when it’s time to expand.

The Crypto Travel Rule Explained: What VASPs Need to Know was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

TL;DR: Mastercard has launched Stablecoin Security, a risk-scoring tool designed to help financial institutions examine payments before and during their movement across blockchains.

Stablecoin transfers can settle quickly. Investigating a suspicious payment before it happens is a much harder task, particularly when the transaction crosses providers, blockchains and traditional banking systems.

Mastercard wants to tackle that problem with Stablecoin Security, introduced at Money20/20 in Las Vegas. The product combines conventional payment intelligence with blockchain data so banks and payment companies can assess fraud, sanctions and scam risks across a transfer’s journey.

The service works through an API and can generate a risk assessment before a transaction is completed. Mastercard says it can consider the payment context, the origin of the funds and potential exposure to restricted parties. Borderless.xyz and Keyrails are the initial partners.

For businesses considering stablecoin settlement, this fills an operational gap. A payment may be technically possible and still raise questions about counterparties, compliance or whether the funds arrived through a compromised wallet.

Mastercard’s announcement cites research covering 593 million stablecoin transfer events and 141 million Ethereum transactions in 2025, finding that almost 60% involved more complex, multi-step routes rather than simple one-to-one transfers.

The company is initially launching in North America and expects wider commercial availability in 2027. It isn’t promising to eliminate fraud, but it is bringing a familiar banking control into an increasingly unfamiliar payment environment.

Written by the News Desk and edited by Samuel Rae.

If you take card payments, even five a day, read this before your bank emails you first.

The mistake is simple. You think your payment provider takes care of PCI DSS for you.

It doesn’t. Some of it, sure. But if your checkout page looks like most checkout pages, a big chunk of the responsibility is still sitting on your desk.

[Add two or three sentences of your own here. A time you or a client assumed “Stripe handles it” and found out otherwise. Real beats polished.]

I’ll get to the gap in a second. First, the title.

Is it actually illegal?

Mostly no, and I’d rather say so now than have someone say it for me in the comments.

PCI DSS isn’t a federal law. The card brands wrote it, and you agreed to it when you signed your merchant agreement, probably without reading page nine. Break it and your bank can fine you, raise your fees, or close your account.

But a few US states have pulled PCI DSS into their own law. Nevada is the best known. Minnesota and Washington have versions too. And after a breach, nobody asks whether the standard was legally binding. They ask whether you followed it. A lawyer on the other side will enjoy that question.

So “breaking the law” is a little strong, and “breaking your contract” is accurate nearly everywhere. Either way, you don’t want to be there.

Who’s living on your checkout page?

Open your checkout page. Right-click, view source, and search for “script.”

Go on. I’ll wait.

Analytics. A chat widget. Maybe a heatmap tool somebody trialled once. A font library. A retargeting pixel from a campaign in 2022 that nobody turned off. Every one of those is code written by a stranger, running in the same window where your customer types a card number.

Attackers love this. It’s called web skimming, and you’ll also see the name Magecart. They don’t bother attacking your bank. They compromise one small third-party script, add a few lines of JavaScript, and copy card details as people type. Your site looks fine. Your processor sees normal transactions. It can go on for weeks.

This is the gap. Your provider secures its side. It has no control over the fifteen scripts you invited onto your side.

What changed, and why old blog posts will mislead you

The old version, 3.2.1, was retired in March 2024. Version 4.0 replaced it, and a batch of requirements that started out as “best practice” became mandatory on March 31, 2025. The current release, 4.0.1, only clarifies wording. It doesn’t relax anything.

Two of the new rules hit online sellers hardest.

Requirement 6.4.3 says you need an inventory of every script on your payment pages. You have to confirm each is authorized and write down why it’s there.

Requirement 11.6.1 says you need a way to detect unauthorized changes to those pages and be alerted when something shifts.

So if nobody on your team can name every script on your checkout, you have a compliance problem and a security problem. They happen to be the same problem, which is almost funny.

What it costs when it goes wrong

The card brands don’t bill you directly. They penalize your acquiring bank, and the bank passes it along, usually with a little extra for its trouble. Figures commonly reported run from about $5,000 to $100,000 a month of non-compliance, depending on your size and how long it drags on.

That’s the fine. A real breach is its own bill: forensic investigators, reissuing cards, lawyers, notifying customers, and the quiet loss of people who just stop buying from you.

Target in 2013 is the example everyone uses, because it’s true. Attackers got in through a third-party vendor (an HVAC contractor, of all things) and left with around 40 million payment card records. A company that size absorbs it. A small shop usually can’t.

What to do this week

None of this is glamorous. That’s sort of the point.

Start by asking your bank or processor which Self-Assessment Questionnaire applies to you. It depends on how card data touches your business, and plenty of merchants fill out the wrong one. They end up compliant on paper and exposed in practice.

Then shrink your scope. If you use a fully hosted payment page or tokenization, card numbers never touch your servers, and that’s less for you to secure and explain. Do an audit of your payment page scripts while you’re at it, and delete anything that isn’t earning its spot. Your heatmap tool doesn’t need to sit next to the card field.

Never store the CVV after authorization. Ever. Turn on multi-factor authentication for any account that can reach card data. If you’re required to run quarterly external scans, use an Approved Scanning Vendor and put the dates in your calendar, because PCI DSS is yearly, not once and done.

And write a security policy. One page is fine. One page your team has read beats sixty pages nobody opened.

The honest takeaway

I don’t think PCI DSS exists to make your life miserable, though it can feel that way around audit time. It exists because card fraud is automated and endless, and small merchants are favorite targets because they assume nobody’s watching.

The businesses that stay out of trouble mostly aren’t the ones with big security budgets. They just ask three dull questions early. What touches card data? Who has access to it? What’s running on my checkout page?

Ask them this week. Your future self will be grateful, and so will your bank.

Do you know which SAQ applies to your business? Tell me in the comments. [Add your own honest answer here.]

This is general information, not legal or compliance advice. Confirm your requirements with your acquiring bank or a Qualified Security Assessor.

Your Payment Page Is Probably Breaking the Law. Here’s the PCI DSS Mistake Nobody Tells You About was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

As crypto payments become more mainstream, proving who is behind a transaction is becoming just as important as moving the money itself.

Crypto was built around the idea that people could move value without relying on traditional financial intermediaries. But there’s a catch:

Once crypto becomes a serious payment system, someone still needs to answer a very old question, who is actually moving the money?

That is where KYC and AML compliance enter the picture. Far from disappearing in a decentralized financial world, identity checks, transaction monitoring, sanctions screening and the so-called Travel Rule are becoming central to how legitimate crypto businesses operate.

Decentralized rails, centralized responsibilities

A blockchain can record transactions without a bank sitting in the middle. But crypto exchanges, payment providers, custodians and other service providers often do have identifiable customers and regulatory obligations.

In the United States, FinCEN has treated certain businesses exchanging or transmitting convertible virtual currency as money transmitters under the Bank Secrecy Act since its 2013 guidance.

In Europe, the direction is even clearer.

The EU’s Markets in Crypto-Assets Regulation, or MiCA, created a harmonized framework for crypto-asset issuers and crypto-asset service providers.

The European Commission also states that covered crypto service providers are subject to the EU’s AML and counter-terrorist-financing framework.

So while the blockchain itself may be decentralized, the companies building businesses around it increasingly are not operating in a regulatory vacuum.

KYC is becoming the front door

Know Your Customer, or KYC, is often treated as an annoying onboarding step. In reality, it is the foundation of a compliance program.

A crypto platform needs to understand who its customer is, where appropriate, who ultimately owns or controls a business, and whether that customer presents unusual or elevated financial-crime risk.

That does not mean every customer should automatically be treated as suspicious.

Modern AML frameworks are increasingly risk-based. A small, ordinary transaction from a verified customer should not necessarily receive the same scrutiny as a complicated flow involving multiple jurisdictions, high-risk counterparties or unexplained sources of funds.

The goal is not simply to collect passports.

It is to build enough context to understand whether a transaction makes sense.

The blockchain doesn’t eliminate AML risk

One of crypto’s biggest misconceptions is that blockchain transparency makes money laundering impossible.

It doesn’t.

Transactions may be publicly visible, but identifying the real person or organization behind a wallet can still be difficult. Funds can move through multiple wallets, exchanges, bridges and other services before reaching their final destination.

The FATF’s July 2026 update specifically highlighted growing risks involving stablecoins, peer-to-peer transactions through unhosted wallets, offshore virtual-asset providers and certain decentralized-finance arrangements. It also warned that major gaps remain in how countries identify, license and supervise virtual-asset service providers.

The numbers show why regulators remain concerned.

Chainalysis estimated that cryptocurrency addresses linked to illicit activity received at least $154 billion in 2025, although that figure is a lower-bound estimate and represented less than 1% of overall attributed crypto transaction volume.

Stablecoins accounted for 84% of illicit transaction volume in its 2026 report.

That last point matters. Stablecoins are useful for legitimate businesses precisely because they can move quickly across borders with relatively low volatility. The same characteristics can make them attractive to criminals.

The technology isn’t inherently criminal. The same rails can serve very different purposes depending on who is using them.

Then came the Travel Rule

KYC answers, “Who is this customer?”

The Travel Rule asks another question:

“What information should travel with this transaction?”

Under FATF standards, relevant information about the originator and beneficiary of certain virtual-asset transfers needs to accompany the transfer between regulated providers.

Implementation is accelerating.

FATF reported in July 2026 that 83% of surveyed jurisdictions had passed legislation implementing the Travel Rule, compared with 73% in 2025.

Yet FATF also noted that enforcement and practical implementation remain uneven.

In the EU, the Travel Rule has already moved into operational territory. The European Banking Authority’s guidelines explain how payment service providers and crypto-asset service providers should handle missing or incomplete information attached to transfers. The guidelines have applied since December 30, 2024.

For crypto businesses, that means compliance can no longer stop at onboarding.

The transaction itself matters.

Compliance is becoming part of the product

This is probably the biggest shift.

A few years ago, compliance could feel like something happening behind the scenes after a crypto product was built. Today, for serious payment businesses, compliance increasingly has to be designed into the product itself.

That can mean automated KYC checks, sanctions screening, wallet-risk analysis, transaction monitoring, suspicious-activity investigations and documented escalation procedures.

It also means understanding the difference between a customer’s normal behavior and genuinely unusual activity.

That distinction is important because over-compliance can create its own problem. If legitimate customers constantly face unnecessary freezes, requests for documents or unexplained delays, the payment experience suffers.

Good compliance should reduce financial-crime risk without turning every customer into a suspect.

The harder problem: crypto moves globally

Traditional financial systems already struggle with cross-border compliance. Crypto makes the problem more immediate because a transaction can move across jurisdictions almost instantly.

One wallet may belong to a customer in one country. The service provider may operate from another. The counterparty may be somewhere else entirely, while the underlying blockchain network has no geographic border at all.

That is why global standards matter.

But FATF’s latest findings also show the limits of having global standards without consistent implementation. Regulation is moving forward, yet countries remain at different stages of licensing, supervision and enforcement.

For businesses, that creates a practical challenge: being compliant in one market does not automatically mean being prepared for every market.

The future of crypto payments may depend on trust

Crypto doesn’t have to choose between decentralization and compliance.

The more interesting future is probably one where decentralized networks handle the movement of value while regulated businesses build the identity, monitoring and accountability layers around them.

That may sound less revolutionary than the early crypto vision. But it could be what finally makes crypto payments useful at mainstream scale.

Because moving money quickly is only half the equation.

The other half is being able to explain where it came from, where it is going, and why the transaction makes sense.

And as crypto becomes part of everyday financial infrastructure, that ability may become one of its most valuable features, not its biggest compromise.

KYC and AML Compliance in Crypto Payments was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.